Kibana ESA-2023-02

Kibana versions before 7.17.9 and 8.6.1 have vulnerability CVE-2022-38900 in one of Kibana's implementation of decode-uri-component, which is vulnerable to Improper Input Validation, which could allow an authenticated attacker to perform a request that crashes the Kibana server process...

Security Bulletin: IBM HTTP Server is vulnerable to HTTP request splitting due to the included Apache HTTP Server (CVE-2023-25690)

Summary IBM HTTP Server used by IBM WebSphere Application Server is vulnerable to HTTP request splitting when using modproxy or the Web Server Plug-in due to the included Apache HTTP Server. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2023-25690 DESCRIPTION...

Important: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

The vulnerability of extensions for providing access to InTouch Access Anywhere and Plant SCADA Access Anywhere, related to errors in processing the relative path to the catalog, allows a hacker to gain read access to files located outside the protected web server.

The vulnerability of extensions for providing access to InTouch Access Anywhere and Plant SCADA Access Anywhere lies in errors in processing the relative path to the catalog. Exploiting this vulnerability could allow a malicious actor to gain read access to files located outside the protected web...

Design/Logic Flaw

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password...

Generex UPS Adapter CS141 安全漏洞

Generex UPS Adapter CS141 is a UPS Uninterruptible Power System adapter from Generex. A security vulnerability exists in Generex UPS Adapter CS141 versions prior to 2.06 that allows an attacker to replace the administrator password by uploading a modified users.json file to a web server...

CVE-2022-47192 Admin password reset via file upload vulnerability in Generex CS141

Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password...

Boa Web Server v0.94.14 - Authentication Bypass

Exploit Title: Boa Web Server v0.94.14 - Authentication Bypass Date: 19-11-2022 Exploit Author: George Tsimpidas Vendor: https://github.com/gpg/boa CVE: N/A Tested on: Debian 5.18.5 Description : Boa Web Server Versions from 0.94.13 - 0.94.14 fail to validate the correct security constraint on th...

Virtual Reception v1.0 - Web Server Directory Traversal Vulnerability

Exploit Title: Virtual Reception v1.0 - Web Server Directory Traversal Exploit Author: Spinae Vendor Homepage: https://www.virtualreception.nl/ Version: win7sp1rtm.101119-1850 6.1.7601.1.0.65792 running on an Intel NUC5i5RY Tested on: all We discovered the web server of the Virtual Reception...

Virtual Reception 1.0 Directory Traversal

Exploit Title: Virtual Reception v1.0 - Web Server Directory Traversal Exploit Author: Spinae Vendor Homepage: https://www.virtualreception.nl/ Version: win7sp1rtm.101119-1850 6.1.7601.1.0.65792 running on an Intel NUC5i5RY Tested on: all We discovered the web server of the Virtual Reception...

Virtual Reception v1.0 - Web Server Directory Traversal

Exploit Title: Virtual Reception v1.0 - Web Server Directory Traversal Exploit Author: Spinae Vendor Homepage: https://www.virtualreception.nl/ Version: win7sp1rtm.101119-1850 6.1.7601.1.0.65792 running on an Intel NUC5i5RY Tested on: all CVE-ID: CVE-2023-25289 We discovered the web server of the...

CVE-2022-48433

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server...

CVE-2022-48433

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server...

Code injection

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server...

CVE-2022-48433

JetBrains IntelliJ IDEA prior to 2023.1 is affected: an API method in the built‑in web server could leak NTLM hashes. Root cause: NTLM hash leakage via a web server API. Impact: potential exposure of authentication material (Cn/a beyond what sources state); CVSS data indicates high confidentialit...

CVE-2022-48433

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server...

CVE-2022-48433

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server...

PT-2023-15777 · Jetbrains · Jetbrains Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2023.1 Description: The issue concerns the potential leak of NTLM hash through an API method in the built-in web server of JetBrains IntelliJ IDEA. Recommendations: For versions prior to 2023.1, updat...

JetBrains IntelliJ IDEA 安全漏洞

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from the Czech company JetBrains. A security vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2023.1, which stems from the possibility that NTLM hashes could be leaked through API method...

Wago PFC200 Authentication Bypass (CVE-2016-9362)

An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 released August 2015, WAGO 750-881 prior to FW09 released August 2016, and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator URL on the web server, a malicious user is able to edit and to view settings without...